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So far, most of existed single-shot quantum coin flipping(QCF) protocols failed in a noisy quantum 
channel. Here, we present a nested-structured framework that makes it possible to achieve partially 
noise-tolerant QCF, due to that there is a trade-off between the security and the justice correctness. 
It is showed that noise-tolerant single-shot QCF protocols can be produced by filling the presented 
framework up with existed or even future protocols. We also proved a lower bound of 0.25, with 
which a cheating Alice or Bob could bias the outcome. 

PACS numbers: 03.67.Dd, 03.67.Hk 


I. INTRODUCTION 


Coin flipping is one of the fundamental cryptographic 
primitives, establishing a random bit between two spa¬ 
tially separated parties, Alice and Bob. The original 
coin flipping protocol was firstly introduced by Blum in 
1981 in the classical setting[I|. Merely three years later, 
Bennett and Brassard extended the same idea to quan¬ 
tum domain by proposing a, hereafter, well-known quan¬ 
tum protocol, namely ”BB84” protocol 0. Not surpris¬ 
ingly, it raised naturally an important theoretical prob¬ 
lem that whether there exists a perfect coin flipping pro¬ 
tocol in which no party can totally control the outcome? 
Fortunately, this problem was resolved in more than a 
decades later by Mayers and Lo and Chau, who proved 
that perfect coin flipping is impossible even in the quan¬ 
tum setting [1,15, since it is widely accepted that classi¬ 
cal cryptography based on unproven computational com¬ 
plexity assumptions might be cracked by quantum com¬ 
puters. 

The first quantum coin flipping(QCF) protocol, i.e., 
”BB84” protocol, has been found a serious security prob¬ 
lem that dishonest Alice can control the protocol entirely, 
i.e., she is able to achieve a bias of 0.5, by performing a re¬ 
mote steering attack[l|, though it is elegant as a template 
for some subsequent variants [1-|1|. Hence, Aharonov et 
al. announced an improved one(ATVY), aiming to van¬ 
quish the remote steering attack, based on a quantum bit 
escrow protocol[l|. However, the bias of their protocol, of 
which the bound is proved up to be 0.354[1|, is not desir¬ 
able yet. Later, Ambainis using qutrits (more than one 
qubit) devised a new QCF protocol whose bias is greatly 
reduced to 0.25[1|. In addition, Spekkens and Ruldolph 
independently proved that fair QCF protocols with the 
same bias, 0.25, can be built upon a restricted class of 
quantum bit commitment protocols [l?ij. Further, Kitaev 


pushed this bound down to (v2 — l)/2 r; 0.21 using 
semidefinite programms(SDP)[ll|. A few years later ^ his 
result was substantiated by Chailloux and Kerenidisfl^. 
who announced a QCF protocol following from the con- 
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struction of using a weak QCF protocol described by 
Mochonfl^ as a subroutine, and proved that its bias is 
arbitrarily close to Kitaev’s bound. In 2011, Hanggi and 
Wullschleger have proved new tight bounds of cheating 
probability p in both classical and quantum cases, for in¬ 
stance, p = y(l — H)/2 corresponds to the quantum set¬ 
tings, where H denotes the honest abort probability [l^. 


Above work mostly contribute to strong quantum coin 
flipping, in which the flavor of each party is not restricted 
by a fixed outcome. We also have a weak version of QCF 
|15l - ll^ differing from the strong one only in that the pref¬ 
erences of the parties are known to each other in advance, 
a more strict definition of these two variants is presented 
in R.efs.[T5 and [H. One of the most significant moti¬ 
vations of initiating the study of weak QCF is to achieve 
perfect coin flipping, which is proved disappointed by 
its strong versions. Most generally, the bias of a weak 
QCF protocol is lower than its counterpart, since one 
can trivially unbalance a strong QCF scheme such that 
the bias of the desired outcome can be lowered at the 
expense of the undesired one[l3|. Remarkably, Spekkens 
and Ruldolph described a protocol whose bias is at most 
(•\/2 — l)/2. Later, it is tightened by Mochon who de¬ 
clared a protocol achieving a bias of 0.192(1^ [I^, and 
thereafter using Kitaev’s formalism, namely semidefinite 
programming, proved that the bias of weak QCF can be 
made arbitrarily small 131. 

Interesingly, QCF has also been fertilised by new 
paradigms with focus on the multiparty scenario. Ambai¬ 
nis et al. investigated multiparty QCF by including both 
weak QCF and strong QCF as the components, hence the 
protocol seems more likely to be a tournament in which 
the parties are divided into pairwise subgroups [15 . It is 
also further studied in real-life applications, such as the 
leader election[2lj|. 


It is known that real-world quantum cryptography sys¬ 
tems, e.g., the intriguing quantum key distribution, have 
always been suffering from some imperfections [23. [23l |. 
Indeed, there is no exception for QCF. In other words, 
QCF is also sensitive to some deviations from its theo¬ 
retical model, such as the noise. With the motivation 
of implementing a real-life QCF system, quantum bit¬ 
string generation has be en prop osed to minimize the un¬ 
expected effect of noise[2J, Hfl]. However, Berlin et al. 
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argue that the same goal can be achieved with purely 
classical means Q- It still leaves open that whether there 
exist nontrivial single-shot QCF protocols of which the 
expected performance can be achieved in the presence of 
noise? 

Of particular attention, loss is an even bigger threat to 
a practical QCF implementation. Differing from that in 
quantum key distribution, it is not difficult for a dishon¬ 
est party to take advantage of it for a malicious purpose 
without even being caught cheating. In fact, any QCF 
protocol is such a cunning two-party game that a loss- 
tolerant protocol is always obtained at a price. QCF was 
first reviewed in the loss-tolerant aspect by Berlin et al. 
who constructed their protocol (BBBG09)upon the BB84 
template, the price for a loss-tolerant characteristic is 
that the bias increased dramatically to 0.40. They also 
experimentall y v erified their protocol in practical quan¬ 
tum channels [ 23 , as is a great progress upon the first 
QCF experiment by G.Molina-Terriza et al. in 2005(2^. 
Subsequently, Aharon et al. presented a class of loss- 
tolerant protocols without the use of bit commitment, 
and the bias can be reduced, though not so remarkably Q. 
With the same purpose, Chailloux recently announced a 
new protocol in which a classical encryption step is added 
to Berlin et al.’s, and it approximately produces a bias of 
0 . 359 ( 2 ^. Later, Anna Pappa et al. proposed a practical 
QGF protocol!^ regarding all possible environmental 
imperfections including loss, noise and the photon source. 
Their protocol also uses the template of BBBG09 proto¬ 
col, except that they replace the photon source with a 
weak pulse laser. Recently, it is reported that they suc¬ 
ceeded in experimentally carrying out a plug-and-play 
QGF scheme using commercial devices 

In this paper, we continue to answer the question in 
Ref. [ 2 ^ that how to develop new ways to reduce the effect 
of noise on the honest abort probability. We present a 
nested structure, with which one can produce a serious 
of partially noise-tolerant QGF protocols, only with an 
acceptable price of justice correctness. The rest of paper 
is organized as follow: In SecHTl a framework, referring to 
the nested structure, is introduced. Then, the security is 
investigated conditioned with channel noises and losses 
in Sec lIIIi and a lower bound is also obtained. In the 
following section, the justice correctness is discussed. At 
last, a conclusion is drawn. 


II. FRAMEWORK 

It is necessary to formalize a quantum noisy channel 
before we present the framework. A natural way to de¬ 
scribe the dynamics of an open quantum system is to 
regard it as arising from an interaction between the sys¬ 
tem of interest, which we shall call the principal system, 
and an environment, which together form a closed quan¬ 
tum system. It is obvious that a quantum channel is 
inevitable of a loss as well as noise in practice, thus we 
introduce a parameter r] to quantify the degree of the 


loss. Since either party can replace a perfect channel or 
detection apparatus, we set 77 = 1 . 

We define penv = |0)(0| as the initial state of the envi¬ 
ronment in a three-level quantum system "He- The envi¬ 
ronment quantum state transform can be written as 

£(p)=TrB(C7e(po(i)®|0)(0|)t/t). (1) 

Here, px is the quantum state Alice prepares in a 
Hilbert space T-La, and the subscript x{x = 0 or 1) stands 
for the encoding of the state. C/g, which describes the 
noisy channel, is a unitary operator acting on the com¬ 
posite system Ha G He- 

Bob measured the received qubit po(i) in a basis ran¬ 
domly chosen from the ones, in which Alice prepares her 
own qubits. This can be described by a POVM operator 
Urn- Therefore, the error rate denoted by p| is written 
as 

= Tr[U,^o)£{p)] ( 2 ) 

where X^o.i n* = 

Since there is a real channel noise and considering a 
honest Alice, if Bob measures a different result in com¬ 
parison with Alice’s one, he has no reason to abort the 
protocol. On the contrary, Alice may cheat Bob like this: 
She simply declares her desired bit to Bob after he has 
revealed his classic bit. Gonsequently, if Bob’s measure¬ 
ment is not corresponding with Alice’s announcement, 
Alice would blame it to a imperfection of the quantum 
system. In other words. Bob is unable to verify between 
a cheating strategy and a truth. Here, to generalize the 
common property of noise-based cheating, we define the 
notion that one can not verify the truth of the other 
party’s word as ’Blinding Area’(iJA). 

Following the same idea, Alice might also take advan¬ 
tage of BA to perform the noise-based cheating as follow: 
By the time she has to reveal the classical information, 
she could announce whatever bit she likes with no risk. 
BA occurs when Bob’s measurement result is inconsistent 
with Alice’s information, i.e.. Bob cannot tell whether it 
is resulted from the noise or Alice’s intention. Gonse¬ 
quently, Bob may abort the protocol in case of judging 
a honest Alice as a cheater due to a genuine error, as is 
referred to an event of justice error. 

The central problem that existed single-shot QCF pro¬ 
tocols failed in a noisy channel is all due to the pres¬ 
ence of BA. Therefore, we are motivated to exploit a 
new technique to reduce its effect. Here, we present a 
framework initialized by the idea of weighing the noise- 
tolerance with the justice correctness. As is showed in 
Fig. [U a nested structure, in which hundreds of QCF 
protocols are correlated, corresponds to the presented 
framework. Each element protocol Vi {i = l,2,...,n) is 
chosen from existed or even future QCF protocols, which 
might be loss-tolerant as well. Protocol Vi^ triggered by 
Vi-i where BA occurs, produces an outcome coin(0 or 


VTb Prob{HA,TB} < q, 
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FIG. 1: Schematics of our framework. It is composed of n 
elements, denoted as Vi (i = 1, 2,..., n). Here, BA, for exam¬ 
ple in Vi, acts an output port which produces a ’’true” result, 
which immediately triggers the next element Vi+i, only if BA 
takes places there. Otherwise, protocol Vi outputs an out¬ 
come coin 0 or 1. oo at the end of the picture indicates the 
outcome as ’’failure”. 


(5) 


where p is the maximal probability for cheating Alice 
and q for Bob. If we implement a QCF protocol in a 
practical quantum channel, the security criteria is given 
by the following two inequalities, 


VTa Prob{NA,TB,Pe} < Pa- (6) 


VTb Prob{HA, Tb, Pej < Pb (7) 

After introducing channel noises, the cheating proba¬ 
bility for Alice immediately turns to be 

Pa = p* + (j> - P*)'x - Pe) +p X Pe, ( 8 ) 

where p^, is the probability that Bob cannot verify Alice’s 
commitment, for example when his measurement basis is 
not consistent with Alice’s. 

For Bob, we have 

Pb = q X - Pe) + q X Pe- (9) 

Obviously, EqslH] and |9] imply that Both Alice and Bob 
performed the same strategies that they ever used in a 
noiseless scenario. 


1 ) with a certain probability, only if it is in absence of 
BA. Notice that the framework might fail in outputting 
a legitimate outcome at the nth level if BA occurs in 
Vn- Also, parameter n should be fixed before Alice and 
Bob begin to run the framework, since it is important to 
bound the biases of both Alice and Bob. 


III. PERFORMANCE 

Before we begin to prove a maximum bias for Alice or 
Bob, it is necessary to summarize some definitions. The 
QBER denoted by 0 < Pe < 1, given by p| from Eql^l 
is used to quantify the degree of error. We denote by 
Prob{TA, Hb} the successful probability for a cheating 
Alice using a tricky strategy Ta while Bob is honest. 
Therefore, an ideal QCF protocol enjoys an equal success 
probability for both parties who are honest, i.e., 

Prob{HA,HB} = ^. (3) 

If one of them uses cheating strategy and the rest re¬ 
mains honest, it can be written as 

(4) 


A. Maximal Biases 

Conventionally, one may presume that a cheating 
party, Alice or Bob, is powerful enough to do anything 
only constrained by quantum mechanics. Therefore, the 
noisy channel may be replaced by the cheater with a 
noiseless one in advance, as is a natural way to maxi¬ 
mize the bias. Here, we shall generalize the biases as 
functions of the noise rate Pe, to make a better interpre¬ 
tation of the framework performance, maximal ones are 
just obtained by letting Pe = 0. Moreover, only the case 
of Pe < 0.5 is taken into account. For Pe > 0.5, a clever 
Alice would always reveal the opposites of her original 
bits, otherwise she will be a victim of channel noises. In 
other words, the probability, that a honest Bob will ob¬ 
tain a measurement result consisted with the original a 
honest Alice reveals, is only I — Pg, which is lower than 
0.5. Therefore, it is reasonable to consider only a case of 
Pe < 0.5, according to this symmetry. 

Interestingly, it is natural from EqslS] and [S] that any 
QCF protocol involves to a perfect one while Pe = 0.5, 
i.e., 

Pa = Pb = 0.5. (10) 

In this case, any QCF protocol seems to be an ’’empty” 
scheme, since the randomness of the outcome coin is to¬ 
tally controlled by the channel. 


VPa Prob{TA, Hb}<p, 
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Using classical probability theory, we have calculated 
the biases, given by Lemma 1 and Lemma 2. Before 
this, we should define Pao,Pbo = for Alice and Bob, 
respectively. Also, we need a further assumption that the 
optimal cheating strategy, which Alice or Bob performs 
on the presented framework, is a combination of the ones 
on each element Vi in a noiseless channel. 

Lemma 1: Given n = N for the presented framework, 
Alice’s bias sa is calculated by 

N i-1 

pW =SA + 0.5 = J2^A,n^- ( 11 ) 

i=l j=0 

Proof For n = 1, we have P^'^ = Pai, where Pai is 
the successful probability that cheating Alice biases the 
coin to her like in protocol Vi. For the case of n = 2, it 
is easy to find 

Pji'’= Pa^ PPl'^ X Pa,. ( 12 ) 

Paj corresponds to the probability that BA took place 
in Vi. Thus, V 2 , triggered by BA in Pi, produces an 
outcome with a probability of Pai x Pa, ■ With the same 
technique, the probability that P„(n = 3,4, ...,A^) pro¬ 
duces an outcome is given by Pa„ PAi ■ Accounting 
with all cases, one immediately has 

N-l 

= Pa, + PaJ\, + • • • + n (13) 

which concludes the proof. 

Following the same template, we have lemma 2 to cal¬ 
culate Bob’s bias. 

Lemma 2: Given n = N for the presented framework, 
Bob’s bias £5 is calculated by 

N i-1 

P^"^) = £5+0.5 = (14) 

i=l j=0 

Corollary 1: The framework cannot be totally con¬ 
trolled by any cheating party, given Vi is a secure QGF 
protocol for all is, i.e., 

pr<i,pr<i (15) 

See Appendix for the proof. 

From Lemmas 1 and 2, it is seen that P^'^ and P^'^ 
simultaneously increase as N grows up, since we have 
Pa{b) - nr=i' Pa(b), > 0 . In other 

words, the security of the presented framework degrades 
as N increases. However, it is possible that the frame¬ 
work ends up with a justice error, that a honest Alice is 
caught cheating due to the presence of noise taking place 
in the Nth round referred to Vn- 


B. Justice Error 

Next, we shall investigate the justice error of our frame¬ 
work, in response to the former claim ’’weighing the 
noise-tolerance with the justice correctness”. Since jus¬ 
tice error only occurs in a situation where Alice is honest 
and Bob is able to verify her commitment, it is not diffi¬ 
cult to compute the justice error rate by 

N 

Psys = l[{l-p^:^)Pe^, (16) 

where Pgys denotes the rate. 

Obviously, the more frequently we restart the proto¬ 
col, the smaller Pgys is, and it reaches to zero when N 
approaches infinity. In this case, the framework is nearly 
broken, while the justice error never occurs. Interest¬ 
ingly, partial noise-tolerance property is achieved with an 
acceptable loss of justice correctness when N is set finite. 
Let p* = 0.5, referring to protocols in which only two 
nonorthogonal basis are employed, we have Pays + 0.25 
for N = 1 and Pays < 0.063 for N = 2, given Pe previ¬ 
ously assumed to be less than 0.5. Therefore, it is happy 
to see that = 2 is sufhcient enough to reduce the effect 
of justice errors. 

Note that justice error is a systematic price for the 
noise-tolerant property, yet it repays us the expected se¬ 
curity of most single-shot QGF protocols which were sup¬ 
posed to fail in noisy channels. 

C. Optimal Situation 

It is clear from above that there is a trade-off between 
the security and the justice correctness, although the pre¬ 
sented framework is partially noise tolerant. Of course, 
parameter N can be forced to be 1, i.e.. Bob firmly calls 
Alice a cheater in case of a; a: despite it is possibly 
due to the channel noises. Gonsequently, the probabil¬ 
ity of being betrayed by a real noise for a honest Alice 
is up to 0.25, which is likely to be unacceptable in real- 
life applications. In addition, it shouldn’t be neglected 
that in real life implementation, a cheating party is pre¬ 
sumed to have unlimited capacity, including replace the 
noisy channel with a noiseless one to maximize his or her 
benefit. We have loosely plotted P^'^ as a function of 
Pe with prefixed parameters in Fig2. It is showed that a 
cheating Alice will gain the most benefit from the channel 
noises by replacing the channel, i.e., Pg = 0. Similarly, 
Bob is encouraged to do so before he decides to cheat 
Alice. 

In an ideal case, where each element protocol Vi is 
perfect, i.e., Pa, = 0.5 and Pb, = 0.5 adapted from the 
argument of Hanggi and Wullschleger, optimal biases of 
the presented framework is achieved. Table 1 is a list of 
the results for the ideal case in specific Ns, it is showed 
that the security is increasingly discounted with N be¬ 
coming larger. Even the protocol is only allowed to be 
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FIG. 2: Successful probability of Alice as a function of P^. (a)The curves are plotted with different Ns, by setting p* = 0.5 and 
p = 0.8 for each element Vi, i.e.,each element Vi shares the same cheating probability. (b)The curves are plotted with different 
ps, and for each we set N = 2. The date point labeled by a rectangle box is directly explained by Eq[Sl 


TABLE I: Some results referring to the ideal cases 

2 0.50 0.7500 0.2500 

3 0.50 0.8750 0.3750 

4 0.50 0.9375 0.4375 

5 0.50 0.9688 0.4688 

6 0.50 0.9844 0.4844 


restarted once, the increase of successful cheating prob¬ 
abilities for both Alice and Bob reach up to 0.25. It can 
be inferred that the bias is approximately approaches 0.5 
with N being sufficiently large, yielding that our frame¬ 
work is completely broken. Combining with the justice 
error rate, it is good to set = 1 when Pe is far less 
than 0.5. Otherwise, one should consider to restart the 
protocol when BA occurs, i.e., let N = 2. 

If we fill the framework with BBBG09 protocol and 
a perfect QCF protocol, for example. Lemmas I and 2 
produce the following two inequalities 

< ^ + X 0-5, (17) 

-b (I - a^) X 0.5. (18) 

Consider a fair scenario, we have 

^-f-ia/3-b[I-(j-(-ia/3)]x0.5 = a^ + {l-a‘^)x0.5, (19) 
subject to -b /3^ = I. Solving this system yields 


Replacing BBBG09 protocol with Chailloux’s 
scheme 1^. we obtain a fair bias of 0.4295. 


IV. CONCLUSION 

We have solved a practical problem in implementing 
single-shot QCF protocols in real-life channels, we proved 
that partial noise-tolerance property is achievable using 
a nested-structured framework, at an acceptable price. 
However, the bias produced by filling the framework up 
with existed loss-tolerant QCF protocols is still unsatis¬ 
fying, it is still meaningful to further develop new loss- 
tolerant QCF protocols with smaller biases. In addition, 
is it possible to introduce our framework to weak QCF 
protocols? Our future work will be focused on above 
concerns. 
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VI. APPENDIX OF COROLLARY 

According to Lemma I, we have 


= 0.9,/3^ = O.I, 
which immediately conclude 


( 20 ) ( 22 ) 

i=0 

(21) which can be rewritten as 


£a = sb = 0.45. 
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Using the same technique, we have 


Elf PA.ir-=l^, 

+ PAn.i PAj 

+Pan Paj ■ 


(23) 


Consequently, it equivalently evolves to 


P 


(N) 


< EflPA^IflPA, 


+ {PAn-i + PAM-iPAN)I\j=o PAj- 


(24) 


Given that ^ < PAi < 1 is true for all is, hence 


pr <ElfPA.ir-JoPA,+uifPA 
< Eh pjh^El T%+nU T% 

= Pai + Pai 

= 1 . 


(27) 


PAn-1 " 1 “ PAn-iPan < 1 - 


(25) 


Thus, the following inequality also holds 


Ph <ElfPA.irEJoPA^ 

ji-i 




= Ehl Pa, Uho n;=o Pa 

+PA..,YhhPA, 

= El=f Pa, Uh Pa. + Pa, ■ 


(26) 


Following the same steps, one could also obtain pf^ 


< 


1 . 
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